machineyearningengineer · Oct 10, 2026 · Oct 10, 2026
diff --git a/README.md b/README.md
@@ -20,11 +20,13 @@ Turn a growing [Raindrop.io](https://raindrop.io) library into something easier
 
 ## Get started
 
-Install through Homebrew or npm:
+v0.2.0 is available through Homebrew and [native downloads](https://github.com/KingPsychopath/raindrop-cli/releases/tag/v0.2.0). Its npm tarballs are built and verified; registry publication awaits the owner's required npm 2FA setup. Use Homebrew or native binaries meanwhile. [Publishing status and commands](docs/PACKAGING.md#npm-packages).
+
+Install:
 
 ```sh
 brew install KingPsychopath/tap/rdrop
-# Or Node 22+, with optional dependencies enabled:
+# After npm registry publication: Node 22+, optional dependencies enabled:
 npm install --global @machineyearn/raindrop-cli@0.2.0
 rdrop version
 ```

diff --git a/docs/CLIENTS.md b/docs/CLIENTS.md
@@ -1,6 +1,6 @@
 # Connect your agent
 
-Use the native `rdrop` executable or the pinned npm launcher from a local MCP client. The server starts read-only, reads the normal private CLI configuration, and keeps stdout reserved for MCP messages.
+Use the native `rdrop` executable or the pinned npm launcher from a local MCP client. The server starts read-only, reads the normal private CLI configuration, and keeps stdout reserved for MCP messages. v0.2.0 npm publication is currently waiting for the owner's required 2FA setup; use native stdio configuration below until the [publishing status](PACKAGING.md#npm-packages) confirms registry availability.
 
 ## Codex and Claude plugins
 

diff --git a/docs/PACKAGING.md b/docs/PACKAGING.md
@@ -14,10 +14,12 @@ The Go version is declared in `go.mod`; CI uses that file. The release workflow
 
 For a released archive, download it and the matching `checksums.txt` from the same [GitHub release](https://github.com/KingPsychopath/raindrop-cli/releases). On Linux run `sha256sum --check checksums.txt --ignore-missing`; on macOS compare `shasum -a 256 YOUR_ARCHIVE` to that archive's entry before extracting it. Do not reuse another release's checksums.
 
-The supplied [Homebrew formula](../packaging/homebrew/rdrop.rb) retains its existing v0.1.0 source URL and verified checksum. Update both when publishing a new release; its `head` option tracks main. A formula's description does not imply that an old tagged version contains development features.
+The [Homebrew formula](../packaging/homebrew/rdrop.rb) and `KingPsychopath/tap` use the v0.2.0 source archive and its verified SHA-256 checksum. The `head` option tracks main. Update the source URL and checksum together after each release tag exists.
 
 ## npm packages
 
+v0.2.0 status (2026-10-10): all seven release tarballs are attached to the [GitHub release](https://github.com/KingPsychopath/raindrop-cli/releases/tag/v0.2.0), their checksums and packed installation passed, but npm rejected registry publication until the owner enables 2FA or supplies an eligible granular publishing token. No npm package was published. Homebrew and native archives are available now.
+
 ```sh
 node --test packaging/npm/launcher.test.cjs
 node scripts/build-npm.mjs 0.2.0-development.1
@@ -41,7 +43,7 @@ gh release download v0.2.0 --dir dist --pattern '*.tgz' --pattern checksums.txt
 node scripts/publish-npm.mjs 0.2.0
 ```
 
-The script checks all seven package manifests, publishes each native package before the launcher, and skips an existing version only when its registry SHA-512 equals the local tarball. It stops on authentication, policy, network or integrity errors; it never overwrites a published version. npm may require browser/2FA approval. `RDROP_RELEASE_DIR` selects another artifact directory and `RDROP_NPM_SCOPE` another owned scope. The release workflow attaches `.tgz` files to GitHub; it does **not** publish npm packages or provision credentials. Install a published release with:
+The script checks all seven package manifests, publishes each native package before the launcher, and skips an existing version only when its registry SHA-512 equals the local tarball. It stops on authentication, policy, network or integrity errors; it never overwrites a published version. npm requires account 2FA or an eligible granular publishing token and may prompt for browser approval. `npm login` alone does not satisfy this publishing requirement; see [npm's publishing policy](https://docs.npmjs.com/requiring-2fa-for-package-publishing-and-settings-modification/). `RDROP_RELEASE_DIR` selects another artifact directory and `RDROP_NPM_SCOPE` another owned scope. The release workflow attaches `.tgz` files to GitHub; it does **not** publish npm packages or provision credentials. Install a published release with:
 
 ```sh
 npx --yes @machineyearn/raindrop-cli@0.2.0 mcp serve

diff --git a/docs/VERIFICATION.md b/docs/VERIFICATION.md
@@ -2,6 +2,33 @@
 
 The 2026-10-10 check used macOS arm64, Python 3.12.13, Ollama 0.40.2, `qwen3:4b` (`359d7dd4bcda`), and Laya 0.4.2 from Git commit `68804629e8ccd9d616d48a40e87de9fabbeae069`. Laya's English checkpoint revision was `7b928d828b7b0e022f929d9bd2e44165aa270148`, running on MPS. The pinned Python environment is [requirements-live.txt](../integrations/laya/requirements-live.txt). These versions were tested on this host; hardware and platform support still depend on the upstream runtimes.
 
+## Released executables
+
+The v0.2.0 release is tagged at `c4c997e748655bfa9b615b3d3eb17ea9952cff40`. All 14 native/npm/plugin artifacts were downloaded and checked against the release's `checksums.txt`. The exact release npm tarballs installed offline, reported the release commit, and completed a real MCP stdio handshake with 26 read-only tools. The downloaded native executable also passed the complete three-step Qwen/Laya loop, dry-run and one fixture update described below. This checks package bootstrap and transport independently of model prose. The source archive has its own Homebrew checksum. The tap's source build and formula tests passed in CI and on the tested macOS arm64 host; the installed version is `0.2.0`.
+
+To repeat with the released macOS arm64 executable instead of a development build:
+
+```sh
+gh release download v0.2.0 --repo KingPsychopath/raindrop-cli \
+  --dir .artifacts/release-v0.2.0 --clobber
+(cd .artifacts/release-v0.2.0 && shasum -a 256 -c checksums.txt)
+tar -xzf .artifacts/release-v0.2.0/rdrop_0.2.0_macos_arm64.tar.gz \
+  -C .artifacts/release-v0.2.0
+.artifacts/release-v0.2.0/rdrop_0.2.0_macos_arm64/rdrop version
+
+# Start the model servers below first.
+HF_HOME="$PWD/.artifacts/hf" \
+LAYA_REVISION=7b928d828b7b0e022f929d9bd2e44165aa270148 \
+python3 scripts/verify-models.py \
+  --binary .artifacts/release-v0.2.0/rdrop_0.2.0_macos_arm64/rdrop \
+  --output .artifacts/e2e/release-models \
+  --command-python .venv-models/bin/python
+
+brew test KingPsychopath/tap/rdrop
+```
+
+Choose the matching native archive on other platforms. npm uses exact release tarballs and verifies each packaged executable before running it; registry publication additionally requires npm account 2FA or an eligible granular publishing token. [Distribution and publishing commands](PACKAGING.md).
+
 ## Start the actual local models
 
 From the checkout:

diff --git a/packaging/homebrew/rdrop.rb b/packaging/homebrew/rdrop.rb
@@ -1,8 +1,8 @@
 class Rdrop < Formula
-  desc "Raindrop CLI, MCP tools and model-driven organizing"
+  desc "Find, review and organize Raindrop bookmarks from a shell or agent"
   homepage "https://github.com/KingPsychopath/raindrop-cli"
-  url "https://github.com/KingPsychopath/raindrop-cli/archive/refs/tags/v0.1.0.tar.gz"
-  sha256 "b53eff457c3c72cdfa553bd052fdad2ca74806798e75e5bd1369defac01b3457"
+  url "https://github.com/KingPsychopath/raindrop-cli/archive/refs/tags/v0.2.0.tar.gz"
+  sha256 "2be3fe887073288141ddc185fa7f639bea143b2275d5f1650c10b0f164130818"
   license "MIT"
   head "https://github.com/KingPsychopath/raindrop-cli.git", branch: "main"